v0.6.0

Cordon 0.6.0

Measured at scale, then shipped: every known-malicious record caught, real lockfiles read the
way Trivy reads them, and code from a teammate or a clone checked before it lands.

   ┌──────────────────────────────────────────────────────────────────────────┐
   │  249,646 known-malicious records         100% caught, 287,899 checks     │
   │  190,274 packages in 1,687 lockfiles     99.6% agree with Trivy          │
   │  8,692 Agent Threat Rules cases          97.7% of attacks, 80.6% of      │
   │                                          evasions, 92.4% of benign clean │
   └──────────────────────────────────────────────────────────────────────────┘

  Map of this release
  ├─ Install ................ pipx · the Action · the containers
  ├─ Incoming code .......... clone and pull, scanned before they land
  ├─ Added .................. review, hosts, live MCP, workloads, intent, packs, policy
  ├─ Measured ............... the at-scale runs, and what they fixed
  └─ Verify it .............. hashes, signatures, provenance

---

Install

   pipx install cordon-scanner==0.6.0          or, already installed:
   pipx runpip cordon-scanner install --require-hashes -r <your pinned requirements>

   GitHub Action   uses: Threx-code/cordon/action@v0.6.0   (pin the commit SHA the tag names)
   Container       ghcr.io/threx-code/cordon:0.6.0        amd64 and arm64; pin it by digest
   Runner          ghcr.io/threx-code/cordon-runner:0.6.0
   Bitbucket pipe  ghcr.io/threx-code/cordon-bitbucket-pipe:0.6.0

Incoming code

   cordon-scanner clone URL        clone --no-checkout, scan the commit from git's objects,
                                   check out only if it passes; a blocked clone is removed
   cordon-scanner pull             fetch, scan what would be merged, merge only if it passes;
                                   a blocked pull leaves the checkout exactly as it was
   cordon-scanner guard install --global
                                   every clone and git init from now on carries post-checkout
                                   and post-merge hooks: a blocked pull, branch switch or clone
                                   is undone before anything has run it

   blocks   anything malicious; anything critical by default (--fail-on high to tighten)
   never    a cordon.yaml, policy or baseline inside the incoming code: it cannot configure
            its own check

Tutorial: 22 · Code arriving from someone else.

Added

   current advisories     unless offline, each scan first fetches what OSV published or
                          changed since the bundled intel was built, every 15 minutes at most;
                          the requests name no package; over a day old marks it incomplete
   review --base REF      what a dependency update adds, upgrades, downgrades and removes;
                          --online fetches, verifies and compares each release   (tutorial 21)
   scan --host / --home   an installed system: dpkg, apk, rpm, pacman, portage, and the
                          language packages and runtimes outside any project     (tutorial 23)
   live MCP               remote servers asked what they serve now, against what was approved
                          with agent mcp-approve                                  (tutorial 18)
   Kubernetes workloads   the images pod templates and Kustomizations run: unpinned, unsigned
   intent, offline        what agent-facing text asks for, in six languages, followed across
                          files: evasions caught 72.3% -> 80.6%
   language packs         Swift, Objective-C, Haskell, Julia, Zig, Nim, OCaml, Clojure
   release comparison     crates.io, RubyGems, NuGet, Go, Hex, pub and Maven, beside npm and PyPI
   the sandbox            RubyGems; a second install with the clock 400 days ahead
   policy                 pinned by digest; fetch-policy; policy-drift; pin bumps everywhere
                                                                                  (tutorial 24)
   images                 Wolfi, Chainguard, Arch, Gentoo; runtimes; default gems; jars

Measured

   real malware, 39,328 samples      94.2% detected; 79.7% by the code alone (0.5.x called
                                     the overall rate "content alone": corrected here)
   the same malware, GuardDog        95.2% against 85.5%, on one fixed-seed draw of 498
   every known-malicious record      249,646 records, 10 ecosystems, none missed
                                     (two were missed on the first run: a 213-character name
                                      and a 74-character version, cut short; fixed)
   container images against Syft     175 images: OS packages 99.9% the same; every package
                                     95.1% mean after stated exclusions; known gaps named
   real lockfiles against Trivy      1,687 lockfiles, 14 registries, 99.6% per package;
                                     every remaining difference sorted by cause, and most are
                                     Trivy listing what the build does not use
   found and fixed on the way        pnpm 10 lockfiles lost their whole tree · npm links named
                                     after their version · Go indirect modules left to go.sum ·
                                     Go never checked against the checksum database

The method, every table and what the numbers are not:
docs/08-ACCURACY.md.

Verify it

   wheel and sdist ... signed, SLSA build provenance; PyPI serves exactly what was uploaded
   images ............ signed keylessly with cosign, SLSA provenance, amd64 and arm64
   SBOMs ............. sbom.cdx.json and sbom.spdx.json attached below
   compared .......... the wheel scanned against 0.5.2's with --compare-with before publishing
   install by hash ... pip install --require-hashes -r action/requirements.txt  (at the v0.6.0 tag)

Every change, in full: CHANGELOG.md, 0.6.0.